CVE-2026-91003

Executive Summary

CVE-2026-91003 is a stack-based buffer overflow (CWE-119) in the D-Link DI-8300 router firmware version 16.07, specifically within the rzgl function handling the /rzgl.asp CGI endpoint. The vulnerability is triggered by manipulating the redirct_url argument, allowing a remote authenticated attacker to corrupt the stack and potentially execute arbitrary code. With a CVSS score of 9.1, public exploit availability, and no confirmed vendor patch, this represents a critical risk for organizations still running this end-of-life device.

Technical Analysis

The vulnerability resides in the rzgl function within the /rzgl.asp file, which is part of the device's CGI (Common Gateway Interface) service. CGI scripts in embedded router firmware typically process HTTP requests, extract user-supplied parameters, and pass them to backend logic—often written in C—without adequate bounds checking.

The specific flaw is a stack-based buffer overflow caused by the redirct_url argument. When a crafted HTTP request supplies an overly long value for redirct_url, the function copies that value into a fixed-size stack buffer without validating its length. This overwrites adjacent stack memory, including saved registers and the return address. Because the buffer is on the stack, an attacker can control the overwritten return address and potentially redirect execution flow to injected shellcode or existing gadgets (ret2libc-style attacks).

The CVSS vector indicates:

• AV:N – Exploitable remotely over the network.
• AC:L – Low attack complexity; no special conditions required.
• PR:H – High privileges required, meaning the attacker must be authenticated to the device's web interface. This may be obtained via default credentials, credential stuffing, or prior compromise.
• UI:N – No user interaction needed.
• S:C – Scope is changed; exploitation may affect resources beyond the vulnerable component (e.g., the entire device firmware).
• C:H/I:H/A:H – High impact on confidentiality, integrity, and availability, consistent with full device compromise.

The redirct_url parameter name (note the typo "redirct") suggests it is used for redirect functionality, likely in an administrative panel or login flow. The rzgl function processes this parameter, and the lack of input sanitization leads directly to the overflow. The public availability of an exploit increases the likelihood of active exploitation in the wild.

It is important to note that no further code-level details—such as exact buffer size, offset to return address, or specific exploitation primitives—are provided in the available intelligence. The analysis above is based on the NVD description and standard characteristics of stack-based buffer overflows in embedded CGI services.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC code was available for review, so specific payloads and offsets are not described.

1. Reconnaissance and target identification
   An attacker scans the internet for D-Link DI-8300 devices using Shodan or similar tools. The device typically exposes an HTTP management interface on port 80 or 443. The presence of the /rzgl.asp endpoint may be fingerprinted via HTTP responses or known paths.

2. Authentication
   The CVSS vector requires high privileges (PR:H). The attacker must first authenticate to the web interface. This could be achieved through default credentials (common on legacy D-Link devices), brute-force, or exploitation of a separate authentication bypass vulnerability. Once authenticated, the attacker can reach the vulnerable CGI script.

3. Triggering the buffer overflow
   The attacker sends a crafted HTTP request to /rzgl.asp with a redirct_url parameter containing an overly long string. The rzgl function copies this string into a fixed-size stack buffer without length validation, causing a stack-based buffer overflow. The exact HTTP method (GET or POST) and parameter encoding are not specified, but typical CGI interactions use either.

4. Payload execution and post-exploitation
   By carefully crafting the overflow, the attacker can overwrite the saved return address and redirect execution to shellcode placed in the request or to existing functions within the binary. Successful exploitation grants arbitrary code execution with the privileges of the CGI process (often root on embedded devices). This allows the attacker to:

   • Install persistent backdoors.
   • Pivot into the internal network.
   • Intercept or manipulate network traffic.
   • Brick or ransom the device.
   • Use the device as a botnet node.

Because the exploit is publicly available, attackers with minimal skill can adapt it. The high CVSS score and public exploit status make this a high-priority target for both opportunistic and targeted attacks.

Impact Assessment

The impact of CVE-2026-91003 is critical. With a CVSS base score of 9.1, the vulnerability allows remote attackers to fully compromise the device. The scope change (S:C) indicates that exploitation can affect resources beyond the vulnerable CGI component—likely the entire router operating system. Confidentiality, integrity, and availability are all rated High:

• Confidentiality: Attackers can read sensitive data such as administrative credentials, VPN keys, and network traffic.
• Integrity: Attackers can modify firmware, configuration, and routing tables.
• Availability: Attackers can crash or brick the device, disrupting network connectivity.

The affected product, D-Link DI-8300, is a wired router often used in small office/home office (SOHO) environments. While it may not be prevalent in large enterprises, it can still be found in branch offices, retail locations, or as part of legacy infrastructure. The blast radius includes any network segment where the device is deployed, as it can serve as a gateway for lateral movement.

The EPSS score of 0.00512 (42.2nd percentile) suggests a moderate probability of exploitation in the next 30 days, but this is likely underestimated given the public exploit. The absence of CISA KEV listing does not diminish the risk, as KEV inclusion often lags behind active exploitation.

Detection Guidance

Sigma Rule

title: D-Link DI-8300 rzgl.asp Stack Buffer Overflow Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to /rzgl.asp with an overly long redirct_url parameter, indicative of CVE-2026-91003 exploitation.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: dlink
detection:
  selection:
    cs-uri-stem|endswith: '/rzgl.asp'
    cs-uri-query|contains: 'redirct_url='
  condition: selection
  # Additional logic: length of redirct_url > 1000 characters
  # Sigma does not natively support length checks; use a regex or pipeline.
falsepositives:
  - Legitimate administrative use with very long URLs (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2026.91003

YARA Rule

rule CVE_2026_91003_DLink_DI8300_Overflow
{
    meta:
        description = "Detects exploitation attempts for CVE-2026-91003 in D-Link DI-8300 firmware"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91003"
        hash = "unknown"
    strings:
        $a = "redirct_url=" nocase
        $b = "rzgl.asp" nocase
        $c = "GET /rzgl.asp" nocase
        $d = "POST /rzgl.asp" nocase
        $overflow = /redirct_url=[A-Za-z0-9%]{500,}/ nocase
    condition:
        any of ($a, $b, $c, $d) and $overflow
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91003 D-Link DI-8300 rzgl.asp Stack Buffer Overflow Attempt"; flow:to_server,established; content:"/rzgl.asp"; http_uri; content:"redirct_url="; http_uri; pcre:"/redirct_url=[^&]{500,}/i"; classtype:attempted-admin; sid:10000001; rev:1; reference:cve,2026-91003;)

Elastic Detection

sequence by host.id with maxspan=5s
  [network where network.protocol == "http" and url.path == "/rzgl.asp" and url.query : "redirct_url=*"]
  [network where network.protocol == "http" and url.path == "/rzgl.asp" and length(url.query) > 1000]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/rzgl.asp" AND uri_query="*redirct_url=*"
| eval param_len = len(mvindex(split(uri_query, "redirct_url="), 1))
| where param_len > 500
| table _time, src_ip, uri_path, uri_query, param_len
| sort - _time

Wazuh OSSEC Rule

<group name="dlink,web,">
  <rule id="100100" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>/rzgl.asp?redirct_url=</match>
    <description>CVE-2026-91003: Potential D-Link DI-8300 stack buffer overflow attempt via redirct_url parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Disable the vulnerable endpoint: If the /rzgl.asp functionality is not required, block access to it at the web server or reverse proxy level.
   • Restrict network access: Place the DI-8300 behind a firewall and limit administrative access to trusted IP addresses only. Disable WAN management.
   • Change default credentials: Ensure no default or weak passwords are in use. Use strong, unique credentials.
   • Enable logging and monitoring: Deploy the detection rules above to catch exploitation attempts.
   • Network segmentation: Isolate the device on a separate VLAN to limit lateral movement if compromised.

2. Patch/upgrade steps

   • D-Link has not released a patch for this vulnerability according to available intelligence.
   • Check D-Link's official security advisory page regularly for updates: https://support.dlink.com/
   • If a firmware update becomes available, apply it immediately.
   • If no patch is forthcoming, consider replacing the device with a supported model.

3. Long-term hardening

   • Replace end-of-life (EOL) devices that no longer receive security updates.
   • Implement a vulnerability management program that includes firmware inventory and monitoring.
   • Use network access control (NAC) to prevent unauthorized devices.
   • Regularly review and audit device configurations for unnecessary services.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-91003
• D-Link Security Advisories: https://support.dlink.com/security-advisories
• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer — https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• EPSS Score Information: https://www.first.org/epss/

No specific threat actor campaigns or exploit-in-the-wild evidence beyond the public exploit publication were provided in the source data.